Rate-Limiting und Quotenverwaltung

Warum Limits?

Rate-Limit oder Kontingent

Token-Bucket-Algorithmus

Redis Token Bucket Example

def allow(user_id, rate=10, capacity=30):
    key = f'rate:{user_id}'
    now = time.time()
    pipe = redis.pipeline()
    pipe.hgetall(key)
    state, _ = pipe.execute()
    tokens = float(state.get('tokens', capacity))
    last = float(state.get('last', now))
    tokens = min(capacity, tokens + (now - last) * rate)
    if tokens < 1:
        return False
    tokens -= 1
    redis.hset(key, mapping={'tokens': tokens, 'last': now})
    redis.expire(key, 60)
    return True

FastAPI Integration with slowapi

# pip install slowapi
from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)
app.state.limiter = limiter

@app.post('/agents/qa')
@limiter.limit('10/minute')
def qa(req: AgentRequest):
    ...

Different Limits Per Tier

class User:
    def __init__(self, is_pro):
        self.is_pro = is_pro

class State:
    def __init__(self, is_pro):
        self.user = User(is_pro)

class Req:
    def __init__(self, is_pro):
        self.state = State(is_pro)

def limit_for(req):
    return '100/minute' if req.state.user.is_pro else '10/minute'

def qa(req):
    limit = limit_for(req)
    print(f'user is_pro={req.state.user.is_pro} -> rate limit {limit}')
    return limit

qa(Req(is_pro=True))
qa(Req(is_pro=False))

Kostenbasierte Kontingente

def check_budget(user_id, predicted_cost):
    key = f'cost:{user_id}:{date.today()}'
    spent = float(redis.get(key) or 0)
    if spent + predicted_cost > daily_budget(user_id):
        raise HTTPException(429, 'Daily budget exceeded')

# After the call:
redis.incrbyfloat(key, actual_cost)
redis.expireat(key, midnight_tomorrow_ts)

Limits für Nebenläufigkeit

key = f'inflight:{user_id}'
redis.sadd(key, request_id)
if redis.scard(key) > 3:
    raise HTTPException(429, 'Too many concurrent requests')
# Remove from set when the request finishes.

Globales Rate-Limit

global_key = 'rate:global:llm'
if redis.incr(global_key) > 60:   # 60 calls per second
    raise HTTPException(503, 'Service overloaded')
redis.expire(global_key, 1)

Return Useful Errors

headers = {
    'X-RateLimit-Limit': '60',
    'X-RateLimit-Remaining': '0',
    'X-RateLimit-Reset': str(reset_time),
    'Retry-After': '30'
}
return JSONResponse({'error': 'rate-limited'}, status_code=429, headers=headers)

Verteilte Rate-Limits

Burst-Spielraum

Alarmierung

Schutz auf zwei Ebenen

Zusammenfassung